HB 3712

Select Language
  ×
The Illinois General Assembly offers the Google Translate™ service for visitor convenience. In no way should it be considered accurate as to the translation of any content herein.
Visitors of the Illinois General Assembly website are encouraged to use other translation services available on the internet.
The English language version is always the official and authoritative version of this website.
NOTE: To return to the original English language version, select the "Show Original" button on the Google Translate™ menu bar at the top of the window.
  Choose Language
  English
  Afrikaans
  Albanian
  Arabic
  Armenian
  Azerbaijani
  Basque
  Bengali
  Bosnian
  Catalan
  Croatian
  Czech
  Danish
  Dutch
  Esperanto
  Estonian
  Filipino
  Finnish
  French
  Galician
  Georgian
  German
  Greek
  Gujarati
  Haitian Creole
  Hausa
  Hawaiian
  Hebrew
  Hindi
  Hungarian
  Icelandic
  Indonesian
  Interlingua
  Interlingue
  Inuktitut
  Irish
  Italian
  Japanese
  Javanese
  Kannada
  Khmer
  Korean
  Latin
  Latvian
  Lithuanian
  Luxembourgish
  Macedonian
  Malagasy
  Malayalam
  Maltese
  Maori
  Marathi
  Myanmar
  Nepali
  Norwegian
  Odia
  Pashto
  Punjabi
  Romanian
  Russian
  Samoan
  Sango
  Sanskrit
  Sardinian
  Sindhi
  Sinhala
  Slovak
  Slovenian
  Somali
  Southern Sotho
  Spanish
  Sundanese
  Swahili
  Swedish
  Tamil
  Telugu
  Thai
  Tigrinya
  Tonga
  Turkish
  Ukrainian
  Urdu
  Vietnamese
  Welsh
  Xhosa
  Yiddish
  Yoruba
  Zulu
  Powered by Translate
  Close
Illinois General Assembly
Top Navigation Bar
  Translate
  Learn
  Select General Assembly
  Search the 104th General Assembly
  Enter search terms for legislation, members, committees, or schedules.
  ILGA.GOV
Mobile Top Bar
  Search the 104th General Assembly
  Enter keywords to search the Illinois General Assembly website.
Full Text of HB3712
Home
Legislation
Full Text
	HB3712 - 104th General Assembly
		Bill Status
		Full Text
		Votes
		Witness Slips
	Select Menu
	Bill Status
	Full Text
	Votes
	Witness Slips
	Printer Friendly Version
			Introduced
		Printer Friendly Version
		Introduced
			 Open PDF
104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB3712
Introduced 2/18/2025, by Rep. Ann M. Williams
SYNOPSIS AS INTRODUCED:
New Act
Creates the Privacy Protections for Location Information Derived from Electronic Devices Act. Makes it unlawful for a covered entity to collect or process an individual's location information except for a permissible purpose. Provides that before collecting or processing an individual's location information for one of those permissible purposes, a covered entity shall provide the individual with a copy of the location privacy policy and obtain consent from that individual Authorizes a civil action in which if the plaintiff prevails, the court may award (1) actual damages including damages for emotional distress, or $5,000 per violation, whichever is greater; (2) punitive damages; and (3) any other relief. Provides that in addition to any relief awarded, the court shall award reasonable attorney's fees and costs to any prevailing plaintiff. Defines terms. Makes other changes.
LRB104 12247 JRC 22354 b
A BILL FOR
		HB3712		LRB104 12247 JRC 22354 b
1    AN ACT concerning civil law.
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
4    Section 1. Short title. This Act may be cited as the
5Privacy Protections for Location Information Derived from
6Electronic Devices Act.
7    Section 5. Legislative intent. The General Assembly
8intends to protect the reproductive health access, safety of
9LGBTQ lives, religious liberty, and freedom of movement by
10passage of this Act.
11    Section 10. Definitions. As used in this Act:
12    "Application" means a software program that runs on the
13operating system of a device.
14    "Collect" means to obtain, infer, generate, create,
15receive, or access an individual's location information.
16    "Consent" means freely given, specific, informed,
17unambiguous, opt-in consent. "Consent" does not include (i)
18agreement secured without first providing to the individual a
19clear and conspicuous disclosure of all information material
20to the provision of consent, apart from any privacy policy,
21terms of service, terms of use, general release, user
22agreement, or other similar document; or (ii) agreement
		HB3712	- 2 -	LRB104 12247 JRC 22354 b
1obtained through the use of a user interface designed or
2manipulated with the substantial effect of subverting or
3impairing user autonomy, decision making, or choice.
4    "Covered entity" means any individual, partnership,
5corporation, limited liability company, association, or other
6group, however organized. "Covered entity" includes all agents
7of the entity. "Covered entity" does not include a State or
8local government agency, or a State court, a clerk of the
9court, or a judge or justice. "Covered entity" does not
10include an individual acting in a noncommercial context.
11    "Device" means a mobile telephone or any other electronic
12device that is or may commonly be carried by or on an
13individual or that is a component part of a motor vehicle and
14is capable of connecting to a cellular, bluetooth, or other
15wireless network.
16    "Disclose" means to make location information available to
17a third party, including, but not limited to, by sharing,
18publishing, releasing, transferring, disseminating, providing
19access to, or otherwise communicating such location
20information orally, in writing, electronically, or by any
21other means.
22    "Individual" means a person located in the State.
23    "Location information" means information derived from a
24device or from interactions between devices, with or without
25the knowledge of the user and regardless of the technological
26method used, that pertains to or directly or indirectly
		HB3712	- 3 -	LRB104 12247 JRC 22354 b
1reveals the present or past geographical location of an
2individual or device within the State with sufficient
3precision to identify street-level location information within
4a range of 1,850 feet or less. "Location information"
5includes, but is not limited to, (i) an internet protocol
6address capable of revealing the physical or geographical
7location of an individual, (ii) Global Positioning System
8(GPS) coordinates; and (iii) cell-site location information.
9"Location information" does not include location information
10identifiable or derived solely from the visual content of a
11legally obtained image, including the location of the device
12that captured such image or publicly posted words.
13    "Location privacy policy" means a description of the
14policies, practices, and procedures controlling a covered
15entity's collection, processing, management, storage,
16retention, and deletion of location information.
17    "Monetize" means to collect, process, or disclose an
18individual's location information for profit or in exchange
19for monetary or other consideration. "Monetize" includes, but
20is not limited to, selling, renting, trading, or leasing
21location information.
22    "Person" means any natural person.
23    "Permissible purpose" means one of the following purposes:
24(i) provision of a product, service, or service feature to the
25individual to whom the location information pertains when that
26individual requested the provision of such product, service,
		HB3712	- 4 -	LRB104 12247 JRC 22354 b
1or service feature by subscribing to, creating an account, or
2otherwise contracting with a covered entity; (ii) initiation,
3management, execution, or completion of a financial or
4commercial transaction or fulfill an order for specific
5products or services requested by an individual, including any
6associated routine administrative, operational, and
7account-servicing activity such as billing, shipping,
8delivery, storage, and accounting; (iii) compliance with an
9obligation under federal or State law; or (iv) response to an
10emergency service agency, an emergency alert, a 911
11communication, or any other communication reporting an
12imminent threat to human life.
13    "Process" means to perform any action or set of actions on
14or with location information, including, but not limited to,
15collecting, accessing, using, storing, retaining, analyzing,
16creating, generating, aggregating, altering, correlating,
17operating on, recording, modifying, organizing, structuring,
18disposing of, destroying, deidentifying, or otherwise
19manipulating location information. "Process" does not include
20disclosing location information.
21    "Reasonably understandable" means of length and complexity
22such that an individual with an 8th-grade reading level, as
23established by the State Board of Education, can read and
24comprehend.
25    "Service feature" means a discrete aspect of a service
26provided by a covered entity, including, but not limited to,
		HB3712	- 5 -	LRB104 12247 JRC 22354 b
1real-time directions, real-time weather, and identity
2authentication.
3    "Service provider" means an individual, partnership,
4corporation, limited liability company, association, or other
5group, however organized, that collects, processes, or
6transfers location information for the sole purpose of, and
7only to the extent that such service provider is, conducting
8business activities on behalf of, for the benefit of, at the
9direction of, and under contractual agreement with a covered
10entity.
11    "Third party" means any covered entity or person other
12than (i) a covered entity that collected or processed location
13information in accordance with this Act or its service
14providers or (ii) the individual to whom the location
15information pertains.
16    Section 15. Protection of location information.
17    (a) It is unlawful for a covered entity to collect or
18process an individual's location information except for a
19permissible purpose. Before collecting or processing an
20individual's location information for one of those permissible
21purposes, a covered entity shall provide the individual with a
22copy of the location privacy policy and obtain consent from
23that individual; however, this shall not be required when the
24collection and processing is done in (i) compliance with an
25obligation under federal or State law or (ii) in response to an
		HB3712	- 6 -	LRB104 12247 JRC 22354 b
1emergency service agency, an emergency alert, a 911
2communication, or any other communication reporting an
3imminent threat to human life. For purposes of this
4subsection, a consumer accessing, procuring, or searching for
5services regarding contraception, pregnancy care, including,
6but not limited to, abortion services, does not constitute an
7imminent threat to human life.
8    (b) If a covered entity collects location information for
9the provision of multiple permissible purposes, it should be
10mentioned in the location privacy policy and individuals shall
11provide discrete consent for each purpose; however, this shall
12not be required for the purpose of collecting and processing
13location information to comply with an obligation under
14federal or State law or to respond to an emergency service
15agency, an emergency alert, a 911 communication, or any other
16communication reporting an imminent threat to human life.
17    (c) A covered entity that directly delivers targeted
18advertisements as part of its product or services shall
19provide individuals with a clear, conspicuous, and simple
20means to opt out of the processing of their location
21information for purposes of selecting and delivering targeted
22advertisements.
23    (d) Consent provided under this Section expires (i) after
24one year, (ii) when the initial purpose for processing the
25information has been satisfied, or (iii) when the individual
26revokes consent, whichever occurs first, as long as the
		HB3712	- 7 -	LRB104 12247 JRC 22354 b
1consent may be renewed pursuant to the same procedures. Upon
2expiration of consent, any location information possessed by a
3covered entity must be permanently destroyed.
4    (e) It shall be unlawful for a covered entity or service
5provider that lawfully collects and processes location
6information to:
7        (1) collect more precise location information than
8    necessary to carry out the permissible purpose;
9        (2) retain location information longer than necessary
10    to carry out the permissible purpose;
11        (3) sell, rent, trade, or lease location information
12    to third parties;
13        (4) derive or infer from location information any data
14    that is not necessary to carry out a permissible purpose;
15    or
16        (5) disclose, cause to disclose, or assist with or
17    facilitate the disclosure of an individual's location
18    information to third parties, unless such disclosure is
19    (i) necessary to carry out the permissible purpose for
20    which the information was collected or (ii) requested by
21    the individual to whom the location data pertains.
22    (f) It is unlawful for a covered entity or service
23providers to disclose location information to any federal,
24State, or local government agency or official unless:
25        (1) the agency or official serves the covered entity
26    or service provider with a valid warrant;
		HB3712	- 8 -	LRB104 12247 JRC 22354 b
1        (2) disclosure is mandated under federal or State law;
2        (3) the data subject requests such disclosure; or
3        (4) a natural person is at risk or danger of death or
4    serious physical injury, as long as:
5            (A) the request is approved by a high-ranking
6        agency officer for emergency access to a consumer's
7        personal information;
8            (B) the request is based on the agency's good
9        faith determination that it has a lawful basis to
10        access the information on a nonemergency basis; and
11            (C) the agency agrees to petition a court for an
12        appropriate order within 3 days and to destroy the
13        information if that order is not granted.
14        For purposes of this subsection, a consumer accessing,
15    procuring, or searching for services regarding
16    contraception, pregnancy care, and perinatal care,
17    including, but not limited to, abortion services, does not
18    constitute a natural person being at risk or danger of
19    death or serious physical injury.
20    (g) A covered entity shall maintain and make available to
21the data subject a location privacy policy, which shall
22include, at a minimum, the following:
23        (1) the permissible purpose for which the covered
24    entity is collecting, processing, or disclosing any
25    location information;
26        (2) the type of location information collected,
		HB3712	- 9 -	LRB104 12247 JRC 22354 b
1    including the precision of the data;
2        (3) the identities of service providers with which the
3    covered entity contracts with respect to location data;
4        (4) any disclosures of location data necessary to
5    carry out a permissible purpose and the identities of the
6    third parties to whom the location information could be
7    disclosed;
8        (5) whether the covered entity's practices include the
9    internal use of location information for purposes of
10    targeted advertisement;
11        (6) the data management and data security policies
12    governing location information; and
13        (7) the retention schedule and guidelines for
14    permanently deleting location information.
15    (h) A covered entity in lawful possession of location
16information shall provide notice to individuals to whom that
17information pertains of any change to its location privacy
18policy at least 20 business days before the change goes into
19effect and shall request and obtain consent before collecting
20or processing location information in accordance with the new
21location privacy policy.
22    (i) It shall be unlawful for a governmental entity to
23monetize location information.
24    Section 20. Prohibition against retaliation. A covered
25entity may not take adverse action against an individual
		HB3712	- 10 -	LRB104 12247 JRC 22354 b
1because the individual exercised or refused to waive any of
2such individual's rights under this Act, unless location data
3is essential to the provision of the good, service, or service
4feature that the individual requests, and then only to the
5extent that this data is essential. This prohibition includes,
6but is not limited to:
7        (1) refusing to provide a good or service to the
8    individual;
9        (2) charging different prices or rates for goods or
10    services, including through the use of discounts or other
11    benefits or imposing penalties; or
12        (3) providing a different level or quality of goods or
13    services to the individual.
14    Section 25. Enforcement.
15    (a) A violation of this Act or a rule adopted by the
16Department of Innovation and Technology regarding an
17individual's location information constitutes an injury to
18that individual.
19    (b) Any individual alleging a violation of this Act by a
20covered entity or service provider may bring a civil action in
21State court.
22    (c) An individual protected by this Act may not be
23required, as a condition of service or otherwise, to accept
24mandatory arbitration of a claim arising under this Act.
25    (d) In a civil action in which the plaintiff prevails, the
		HB3712	- 11 -	LRB104 12247 JRC 22354 b
1court may award:
2        (1) actual damages, including damages for emotional
3    distress, or $5,000 per violation, whichever is greater;
4        (2) punitive damages; and
5        (3) any other relief, including, but not limited to,
6    an injunction or declaratory judgment that the court deems
7    to be appropriate.
8        (e) For purposes of subsection (e) of Section 15, a
9    covered entity that, in more than one instance, violates
10    (1) through (4) of Section 15, from the same person using
11    the same method of collection or sale in violation of
12    subsection (e) of Section 15 has committed a single
13    violation of subsection (e) of Section 15 for which the
14    aggrieved person is entitled to, at most, one recovery
15    under this Section.
16        (f) For purposes of subsection (f) of Section 15, the
17    court shall consider each instance in which a covered
18    entity or service provider collects, processes, or
19    discloses location information in a manner prohibited by
20    subsection (f) of Section 15 as constituting a separate
21    violation of this Act or rule adopted under this Act.
22        (g) Upon motion, a court shall award reasonable
23    attorney's fees and costs, including expert witness fees
24    and other litigation expenses, to a plaintiff who is a
25    prevailing party in any action brought under this Act. In
26    awarding reasonable attorney's fees, the court shall
		HB3712	- 12 -	LRB104 12247 JRC 22354 b
1    consider the degree to which the relief obtained relates
2    to the relief sought.
3        (h) For the purpose of this Act, "prevailing party"
4    includes any party:
5            (1) who obtains some of the requested relief
6        through a favorable judicial judgment;
7            (2) who obtains some of the requested relief
8        through any settlement agreement approved by the
9        court; or
10            (3) whose pursuit of a nonfrivolous claim was a
11        catalyst for a unilateral change in position by the
12        opposing party relative to the relief sought.
13    (i) Any provision of a contract or agreement of any kind,
14including a covered entity's terms of service or policies,
15including, but not limited to, the location privacy policy,
16that purports to waive or limit in any way an individual's
17rights under this Act, including, but not limited to, any
18right to a remedy or means of enforcement, is deemed contrary
19to State law and is void and unenforceable.
20    (j) No private or government action brought under this Act
21precludes any other action under this Act.
22    Section 30. Nonapplicability. This Act does not apply to
23location information collected from a patient by a health care
24provider or health care facility, or collected, processed,
25used, or stored exclusively for medical education or research,
		HB3712	- 13 -	LRB104 12247 JRC 22354 b
1public health or epidemiological purposes, health care
2treatment, health insurance, payment, or operations, if the
3information is protected from disclosure under the federal
4Health Insurance Portability and Accountability Act of 1996 or
5other applicable federal and State laws, rules, and
6regulations.